UBUNTU-CVE-2026-98287

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

CVE-2026-98307

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11kmacpeercleanupall When mac80211 removes a sta, it calls .stastate which in turn calls ath11kmacstationremove. In that function we clean up both peers & arsta related resources. But when the...

CVE-2026-98327

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh-csa is allocated in ieee80211meshcsabeacon and only freed in ieee80211meshfinishcsa, i.e. when the channel switch completes. Leaving the mesh while a switch is still...

CVE-2026-98343

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dmachanput and dmareleasechannel When dmadeviceput drops the last reference on chan-device-ref, dmadevicerelease runs and may free the dmadevice along with its channels. dmachanput then still read...

CVE-2026-98184

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiexcfg80211authenticate derives the authentication frame length from req-ielen and req-authdatalen, both of type sizet, but stores it in a u16. NL80211ATTRAUTHDATA...

UBUNTU-CVE-2026-98204

In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...

UBUNTU-CVE-2026-98262

In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCIHFLAG32BITONLY A user reported that commit 105c42566a55 "ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585" made the JMicron JMB585 unusable on his board. The failure is seen as so...

UBUNTU-CVE-2026-98207

In the Linux kernel, the following vulnerability has been resolved: mmc: spi: reset bytesxfered before retrying CRC failures mmcspidatado updates data-bytesxfered after each block has been transferred successfully. If a later block in the same data request fails with a CRC error, data-bytesxfered...

CVE-2026-98361

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

CVE-2026-98357

In the Linux kernel, the following vulnerability has been resolved: IB/isert: wait for deferred control PDU completions before releasing the connection isertsenddone hands ISTATESENDTASKMGTRSP, ISTATESENDREJECT and ISTATESENDTEXTRSP completions off to isertcompwq and returns. The work item then...

CVE-2026-98355

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if initpath errors, the callee tries to clean up with rtrscltcloseconns. However, this can lead to calling the event tracing code with cltpath-kobj-name being NULL and thus...

CVE-2026-98354

In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ibmadcompleterecv initializes madrecvwc-rmpplist and then runs ibmadenforcesecurity before linking recvbuf onto that list. On failure it calls ibfreerecvmad, which onl...

CVE-2026-98353

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create path holds the plain xalock, the look...

CVE-2026-98340

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, cfg80211bssupdate looks for an existing entry with the same BSSID and a hidden zero-length or NUL-filled SSID, and if ...

CVE-2026-98189

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and reads tha...

CVE-2026-98238

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

CVE-2026-98274

In the Linux kernel, the following vulnerability has been resolved: net: psp: avoid conflicts with skb-decrypted and skvalidatexmitskb PSP conflicts with TLS ULP in its usage of both skb-decrypted and sk-skvalidatexmitskb. Make PSP mutually exclusive with TLS ULP, the only other user of either of...

CVE-2026-98226

In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix SWAPUSAGEOFFLISTBIT collision with real usage count SWAPUSAGEOFFLISTBIT is embedded in the si-inusepages usage counter, and is meant to sit above any value that counter can reach. However, it is defined from...

CVE-2026-98287

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

CVE-2026-98298

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...